[svlug] Firewalls?

[Raj Shekhar]

Skip Evans wrote:

> But anyway, our servers here are always getting 
> hit with script kiddies running ssh login 
> attempts, running down the alphabet of possible 
> user names, etc. They have no chance to get in but 
> it sure is annoying watching the server lights 
> flash and seeing all that traffic on our network.

This has come up once earlier too on this mailing list.  IIRC, the 
methods that were recommended were (in no particular order)
  - change the sshd listener port
  - allow only key-based logins
  - use denyhosts (http://denyhosts.sourceforge.net/)
  - someone pointed to this netfilter magic 
http://blog.andrew.net.au/2005/02/16#ipt_recent_and_ssh_attacks


> 2) Recommendations for a specific installation 
> would be great, and finally;

I don't have a hands-on experience doing this, but this seems like a 
good idea for a firewall < 
http://www.onlamp.com/pub/a/bsd/2004/03/11/Big_Scary_Daemons.html>

-- 
raj shekhar
facts: http://rajshekhar.net | opinions: http://rajshekhar.net/blog
I dare do all that may become a man; Who dares do more is none.